Frequently asked questions
FAQ for the operator
What is the scope of the new RPO?
The new RPO applies to all national telephone numbers, whether published in telephone directories (called public or fixed) or not, including mobile phones, and to postal addresses in public telephone directories. Therefore, the scope includes calls from abroad.
What does “operator” mean?
“Operator” shall mean any subject, natural or legal person, who, in his capacity as data controller, intends to use the data and national telephone numbers by telephone or paper mail for the purpose of sending advertising material, direct sales, commercial communication and for carrying out market research.
Why should I subscribe to the RPO as an operator?
Operators who process national telephone numbers for telemarketing purposes through the use of the telephone (both human-operated and automated calls) and/or paper mail must, as per mandatory requirements, consult the lists of their contacts with the RPO when required by current legislation.
Does the operator have to submit any number he intends to contact for marketing purposes?
The operator shall consult the RPO if he intends to call numbers of people who are not his customers, with or without the intervention of a human operator.
If a consent to marketing calls has been collected by an operator under an existing contract or has been terminated for less than thirty days, does the operator have to consult RPO before contacting the user?
No, if the contract with the contractor has a continuity character. Anyway, the exemption applies only to the operator to whom the contract refers and not to third parties to whom the data have been transferred. Operators must provide the citizen with simplified procedures to revoke such consents.
If consent to telemarketing has been collected as part of a contract that has been terminated for more than thirty days, is it necessary to consult RPO before contacting the user?
If the citizen has requested to be called, does the operator have to consult the RPO before contacting the user?
In the case of calls at the request of the citizen, it is not necessary to consult the RPO in advance. Provided that this request must be understood as a one-off and cannot be extensively interpreted as consent to marketing calls.
In the event of the transfer of a list, do both the transferor and the transferee have the obligation to consult the RPO?
Yes. The obligation to consult the RPO lies with each independent data controller, who by consulting the RPO could obtain different results from other companies due to the selective revocations.
How to meet the obligation to inform citizens in the event of data being transferred to third parties?
This obligation is for the: a) transferor, who must communicate to the data subject the parties to whom the data were transferred (it is not sufficient to indicate only the product category); b) transferee, who does not acquire the data from the data subject and is therefore subject to providing the information pursuant to art. 14 of the GDPR.
Does the prohibition of the transfer of communication to third parties, transfer and dissemination of the telephone numbers subscribed to the RPO also apply to the relationships between the data controller and the data processor or joint controller?
This prohibition applies to any party unrelated to the relationship involving the operator and the telephone contractor. The data controller can however use third parties who work on his behalf as data processors.
According to the joint and several liability pursuant to art. 1, paragraph 11, of law 5/2018, can the call centers be considered as joint controllers?
No. Call centers generally act as data processors.
May mobile phones be contacted without consent after starting the new service?
No. The opt-out regime, i.e. the possibility of contacting users through a human operator for marketing purposes without the need for consent, applies only to data listed in the public telephone directories.
What obligations do I have to fulfil with the new RPO?
Telemarketers are obliged to respect the acquired rights of telephone contractors subscribed to the RPO, including:
- Right to opt-out to telemarketing (human operator calls and paper mail)
- Cancellation of consents issued for the processing of numbers using the telephone (with or without the intervention of a human operator)
- Prohibition of disclosure to third parties, transfer and dissemination of personal data of subscribers to the Public opt-out registry (RPO), by the data controller, for the aforementioned purposes not related to the activities, products or services offered by the data controller
Who has to subscribe to the RPO as an operator?
The data controller company that intends to use postal addresses in public telephone directories and all national telephone numbers for telemarketing purposes through the use of telephone and/or paper mail must subscribe to the RPO as an operator.
Must a company carrying out call centre activities on behalf of a telemarketing operator be subscribed to the public opt-out registry?
The data controller company that intends to verify lists of numbers to be contacted for telemarketing purposes must subscribe to the RPO.
How should the telemarketing operator who delegates the call centre activity to external companies behave?
An operator delegating the call centre activity to external companies, to which it provides a list of numbers to be contacted, is required to subscribe to the RPO indicating all the companies that will physically make the contacts. The list of these companies must be kept up-to-date by the operator subscribed to the RPO via the “Data update” procedure.
How should the company carrying out telemarketing activities for third parties behave?
If the company carrying out telemarketing activities on behalf of third parties holds the ownership of the list of numbers to be contacted, it must subscribe to the RPO without specifying the client; otherwise, the telemarketer who commissioned the promotional activity, who holds the ownership of the personal data and is subscribed to the service, must indicate the call centre company among the persons who physically make the calls.
How can i subscribe to the RPO as an operator?
In order to subscribe to with the RPO as an operator, you have to fill in the appropriate electronic form, using one of the following modes:
- PEC (certified e-mail) and digital signature (with legal value)
- registered letter with acknowledgement of receipt and handwritten signature
Once you have finished entering all the required data in the electronic form, you will have to follow the instructions that will be communicated to you by the system in order to send the necessary documentation to the RPO. Only upon completion of this phase will you receive the contractual documentation, which you must return signed, thus finalising your subscription to the RPO (also known as “Submission of application”), which involves mandatory acceptance of the General contractual conditions and the acquisition of an initial quantity of tests.
How can I check whether my subscription as an operator to the RPO was successful?
You can check whether your subscription to the RPO was successful by verifying the presence of your references in the list of contact list operators published on the service’s website on the “Participating operators” page. Furthermore, the operator’s authorisation to use the Reserved area of the RPO is promptly communicated to the e-mail/PEC (certified e-mail) address of the contract signatory indicated in the subscription form.
What do I need to subscribe to the RPO as an operator?
In order to subscribe to the RPO as an operator, you have to enter all the required data when filling in the appropriate electronic form consisting of several phases. Once the subscription form has been filled out in full, you need to send all the documentation listed in order to complete the operation.
Once you have completed the subscription phase, you will receive the contractual documentation which you must return signed together with proof of payment of the invoice for the purchase of the first quantity of tests. Finally, you will be informed whether your subscription was successful and, if so, you will be able to work with the RPO via the Reserved area. In order to access the Reserved area of the RPO website, you have to equip yourself with some necessary tools (choose between SPID, CNS and digital certificate), or you can operate via PEC and digital signature.
How long does subscription to the RPO as an operator last?
Subscription to the service as an operator does not expire and does not have to be renewed, although the law stipulates that its validity expires 12 months after the last RPO consultation.
Does subscription to the RPO as an operator have a cost?
There is no cost for subscribing to the RPO as an operator, although an initial quantity of tests for access to the RPO is to be purchased during the procedure.
Is it possible to subscribe to the public opt-out registry without purchasing an initial quantity of tests?
No. When subscribing to the General Terms and Conditions with the Public opt-out registry, the operator is obliged to purchase an initial quantity of tests at the same time. For further information, please refer to Article 2 of the General Terms and Conditions.
Does consulting the RPO as an operator have a cost?
Operators required to consult the Public opt-out registry must pay the service provider access fees, which are set by a special Decree of the Minister for Economic Development, in accordance with Article 6(1) of Presidential Decree No. 26/2022.
Why do I have to subscribe to the general terms and conditions of the RPO?
At the end of the subscription procedure, the operator must sign the General Terms and Conditions for access to the RPO, in accordance with the service contract between the Ministry of Economic Development and the Ugo Bordoni Foundation, as operator of the RPO.
What data should I check with the RPO before an advertising campaign?
Prior to an advertising campaign conducted by telephone and/or paper mail (only for addresses in public telephone directories associated with users), the operator must send the RPO the list of telephone numbers whose processing for telemarketing purposes he/she intends to carry out.
How often should I consult the RPO?
The frequency of consultation of the RPO is defined by Article 1(12) of Law No. 5/2018.
What is the difference between telephone RPO and postal RPO?
The Telephone RPO relates to the right to opt-out and cancel consents to telemarketing calls, while the Postal RPO concerns the processing of addresses in public telephone directories. The match key for both registries is the telephone number. The list of numbers returned by the Telephone RPO is only valid for telemarketing calls and not for paper advertising, and vice versa as far as the Postal RPO is concerned.
How can I operate the RPO for consulting contact lists?
In order to work with the RPO for list consultation, you have to subscribe to the RPO by filling in the appropriate electronic form and completing the procedure by submitting the required documentation. Within fifteen days from the actual receipt of the duly signed contractual documentation including proof of payment of the invoice for the first quantity of tests purchased, the RPO shall communicate to the operator the authentication credentials and authorisation profiles to be able to operate in the Reserved area for sending contact lists.
Must the digital signature of the legal representative signing the contract with the RPO be the same as that of the contact lists to be sent?
The contract with the RPO must be signed by the legal representative of the operator, i.e. by the person with signatory powers or power of attorney indicated in the electronic subscription form, while the lists of contacts for consultation of the RPO must be signed by a technical contact person (indicated during the service subscription). If proceeding via PEC, the request must contain the digital signature of the technical contact person. If, on the other hand, you choose to operate in web mode via the technical contact person’s access to the operator’s reserved area, the submitted list does not have to be signed. A change in the name of the technical contact person can be communicated to the RPO via the “Data update” feature of the Reserved area.
What must the list of contacts to be sent to the RPO contain?
The list of contacts to be sent to the RPO must contain only the telephone numbers that the operator intends to contact for marketing purposes for both the Telephone RPO and the Postal RPO, without any indication of the subscriber’s name or postal address associated with it in public telephone directories.
In what format should the contact list be sent to the RPO?
The list file to be sent to the RPO must be in ASCII-encoded text format and must contain numbers consisting of numeric digits, separated by “line feed” and “carriage return” characters. The file must then be compressed according to the deflate algorithm specified in the IETF document RFC1951 (commonly referred to as zip format). If sent by PEC, the .zip file must be additionally digitally signed in PKCS7 format (.p7m).
Should the numbers contained in the sent list include the international dialling code?
No, no international dialling code must be entered.
In the telephone numbers in the sent list, should the dialling code and the telephone number be separated with a character (e.g. space, dot, etc.)?
No, the dialling code and the number must be inserted in the file without separators.
Are simplified guides available for creating the list to be sent?
The “Simplified Windows Guide” provides access to an unofficial guide presenting an example of list generation using the tools available on the Microsoft Windows operating system.
The “Simplified Linux Guide” provides access to an unofficial guide that presents an example of list generation using the tools available on the Ubuntu Linux operating system.
What does the list returned to the operator by the RPO contain?
The list returned by the RPO contains all the numbers checked by the operator with evidence of whether or not they are subscribed to the service and, only in the case of consultation of the Telephone Registry, the possible date of cancellation of telemarketing consents.
How are the administrative details of the result of the verification operation (e.g. total numbers and credit balance) communicated?
Inside the compressed archive, along with the updated list file, a summary text file will be inserted, containing the administrative data of the result of the operation.
Which files returned by the manager are digitally signed and what type of signature is adopted?
In the web-based submission mode, notification messages sent to the e-mail address of the technical manager who made the submission are digitally signed.
In PEC mode, the compressed archive containing the updated list file and the summary text file containing the administrative data of the result of the operation is digitally signed.
The processing system uses the remote digital signature system with automatic procedure offered by ArubaPEC. In exceptional cases, in order to keep response times within the service standards guaranteed to date, an electronic signature system may be used in the name of the Director of the Organisation, Planning and Project Development Department of the Ugo Bordoni Foundation, which relies on the certifier Trust Italia (in which case the e-mail address contained in the signature certificate may be subject to change and is not set up for any kind of communication by operators).
What is the validity of the contact list returned by the RPO?
The returned list is valid for 15 days in the case of consultation of the Telephone Registry and for 30 days in the case of consultation of the Postal Registry. These deadlines run: in the case of PEC mode, from the instant of receipt of the updated list by the operator’s PEC manager; in the case of web mode, from the instant of on-line publication of the updated list, i.e. the instant of receipt of the updated list in the reply and digitally signed by the RPO manager.
How many telephone numbers can a list to be verified with the RPO contain? Is there a limit to the number of lists that can be sent per day?
A list must contain no more than 1,000,000 (one million) numbers. A maximum of five lists may be sent to the RPO per day, but in special cases up to 15 lists may be sent in a single day, for a total of 15,000,000 numbers.
How soon does the RPO return the contact list sent by the operator?
According to the Regulation governing the service, the RPO must return the contact list sent by the operator within 24 hours of receipt. Currently, the average return time is less than 15 minutes.ore ai 15 minuti.
Who can access the reserved area?
The reserved area offers two separate profiles, reserved for the technical contact person and the administrative contact person. An operator may have up to five technical profiles and up to five administrative profiles, but the same person may be declared for both profiles.
What does the operator need in order to access the reserved area?
The technical or administrative contact person who wishes to access the reserved area must be able to authenticate himself/herself by one of the following methods: SPID, National Services Card – CNS, Individual Digital Certificate. The individual digital certificate must contain the name and surname of the contact person logging in. The types of individual digital certificates recognised by the system can be found in the appendix to the “Operating instructions” for sending lists.
What is the difference between the technical and administrative contact person?
The technical contact person is the person delegated to send and receive contact lists for consultation of the RPO, while the administrative contact person is responsible for dealing with the RPO regarding requests for changes to data already communicated and requests to top up verification credit.
What features are available in the reserved area?
In the Reserved area of the technical contact person, it is possible to:
- Send new contact lists for Telephone and Postal RPOs
- Receive contact lists verified by the RPO
- View the history of all sent lists
- Display the credit balance
- Change your password
In the private area of the administrative contact person, it is possible to:
- Purchase credit for contact list verification
- Display the credit balance
- Display the subscription data (“Submission of application”)
- Update subscription data
- View the history of all sent lists
- Change your own and/or other contact persons’ passwords
What is the procedure to be followed if the operator loses his/her access credentials?
The procedures for requesting a new password, like those for requesting a change of access credentials, are published in the “Operating instructions” section of the Public opt-out registry website.
Who can the operator contact for information on the service offered by the public opt-out registry?
For this type of information, you can send an e-mail support request to email@example.com.
Who can the operator contact in case of technical or procedural problems during subscription, accessing the reserved area and sending number lists?
In such cases, you can send an e-mail support request to firstname.lastname@example.org.
What are the fines for telemarketers who violate the RPO?
Violation of the right of telephone contractors to opt-out – i.e. non-compliance with the RPO by telemarketers – is regulated by the Italian Personal Data Protection Code and by the General Data Protection Regulation (GDPR), which provide for the application of administrative fines of up to EUR 20 million or for companies, up to 4% of the total annual worldwide turnover of the previous year, whichever is higher.
How can I delete my RPO subscription?
You can cancel your subscription to the RPO via the “Withdrawal from contract” feature accessible from your Reserved area.
I could not find the information I was looking for: who can I contact?
If you did not find the information you were looking for in the FAQs for the operator, you can send a request to the references in the “Contact for the operator” section.